kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

HTML-escape csrf meta contents

Browse source
This commit is contained in:
Jeremy Kemper 2010-02-04 17:45:43 -08:00
parent 2191aa47ac
commit 3062bc70ef
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
actionpack/lib/action_view/helpers/csrf_helper.rb
View file

@ -4,7 +4,7 @@ module ActionView
# Returns a meta tag with the request forgery protection token for forms to use. Put this in your head.
def csrf_meta_tag
if protect_against_forgery?
%(<meta name="csrf-param" content="#{Rack::Utils.escape(request_forgery_protection_token)}"/>\n<meta name="csrf-token" content="#{Rack::Utils.escape(form_authenticity_token)}"/>).html_safe
%(<meta name="csrf-param" content="#{Rack::Utils.escape_html(request_forgery_protection_token)}"/>\n<meta name="csrf-token" content="#{Rack::Utils.escape_html(form_authenticity_token)}"/>).html_safe
end
end
end

4
actionpack/test/controller/request_forgery_protection_test.rb
View file

@ -210,7 +210,7 @@ class RequestForgeryProtectionControllerTest < ActionController::TestCase
@request = ActionController::TestRequest.new
@request.format = :html
@response = ActionController::TestResponse.new
@token = "cf50faa3fe97702ca1ae"
@token = "cf50faa3fe97702ca1a/=?"
ActiveSupport::SecureRandom.stubs(:base64).returns(@token)
ActionController::Base.request_forgery_protection_token = :authenticity_token
@ -227,7 +227,7 @@ class FreeCookieControllerTest < ActionController::TestCase
@controller = FreeCookieController.new
@request = ActionController::TestRequest.new
@response = ActionController::TestResponse.new
@token = "cf50faa3fe97702ca1ae"
@token = "cf50faa3fe97702ca1a/=?"
ActiveSupport::SecureRandom.stubs(:base64).returns(@token)
end